Case Level Permissions

Each QPR ProcessAnalyzer model has a Configuration field containing model related settings in a JSON format. When the model JSON configuration is changed, the model is dropped from the memory. The following settings are stored to the model JSON settings:

• Calculated attributes
• Model datasources (datatables, ODBC, expressions)
• Automatic loading on server startup
• Memory usage settings
• Case Permissions

Automatic Loading on Server Startup

QPR ProcessAnalyzer models can be loaded automatically into the server memory, when QPR ProcessAnalyzer Server starts. Especially when models are large and loading takes a long time, it's beneficial to load the models beforehand. In the model JSON settings, when the LoadOnStartup property is set to true, the model is loaded automatically during QPR ProcessAnalyzer Server startup. The JSON configuration is as follows:

{
  "LoadOnStartup": true,
  "CacheUsage": {
    "DropUnusedModelsAfter": "100.00:00:00",
    "DropUnusedFiltersAfter": "00:30:00"
  }
}

Notes:

• For models that are set to load automatically on server startup, you also need to set the CacheUsage/DropUnusedModelsAfter setting to a large value (as shown by the previous example), to make sure that it remains in the memory even if it's not used.
• It's possible to control how many models are loaded simultaneously at maximum, to limit how much server capacity the model loading can use. The default value is two models at the same time. To change this setting, see the PA_Configuration table. This setting only affects the model loading on startup (not model loading initiated by users). If loading of a model fails, the loading just continues to the next model.
• For the LoadOnStartup setting to work, IIS configuration for the QPR ProcessAnalyzer Server need to be in place.

Case Permissions

The Permissions section specifies data security restrictions for objects within the QPR ProcessAnalyzer model (i.e. limit visibility). If the Permissions section hasn't been defined, all the model data is visible to users having the GenericRead permission for the project of the model. Case security restrictions are effective for all users, but users who have the GenericWrite permission, can change the case permissions setting for a model and thus workaround the security limitations enforced by case permissions.

Property	Description
Permissions/Case	Expression language expression determining which users can see each Cases. The expression is evaluated within the context of each Case. If the evaluation results true, the Case is visible for the user. Otherwise the Case, its Events and case and event attributes are not visible. This setting implements case level security restrictions.
Permissions/Initialization	Expression language expression used to make an initial calculation for all the other expressions within this same permissions context. This expression can be used to improve performance when part of the Case or EventLogKey expressions are common and thus they don't need to be calculated again for every Case separately. See the examples below of using the Initialization expression.
Permissions/EventLogKey	Expression language expression used to uniquely identify all the unique event logs created by case permission filters. If a cached EventLog with the same key is already in the system, that EventLog is used instead of creating a new. The new EventLog is created by applying the Case expression to filter the Cases users have rights to.

Example usecase for case permissions

Case level permissions (security control) can be implemented with the principle illustrated in the image below. Users already belong to certain groups in the user management, and cases have certain case attribute values which is part of the loaded process mining data. Additionally, the linkage between case attribute values (of a certain case attribute) and groups needs to be defined when this security feature is configured. The image below illustrates the chain between users and cases, how certain users are able to see certain cases when viewing analyses from a QPR ProcessAnalyzer model.

Example: There are groups G1, G2 and G3. Case permissions have been set as follows:

• group G1 can only see cases where (case attribute) Region is Dallas
• group G2 can only see cases where Region is Austin
• group G3 can only see cases where Region is either Austin or New York

QPR ProcessAnalyzer model contains the following cases:

Case name	Region (case attribute)	Groups can see
A	Dallas	G1
B	Dallas	G1
C	Austin	G2, G3
D	New York	G3
E	New York	G3
F	New York	G3

Thus, when viewing analyses, a user see that the model contains the following cases:

• If the user belongs to group G1 only, the user can see cases A and B (2 cases)
• If the user belongs to group G2 only, the user can see case C (1 case)
• If the user belongs to group G3 only, the user can see cases C, D, E and F (4 cases)
• If the user belongs to groups G1 and G2 only, the user can see cases A, B and C (3 cases)

There is no way for a user to be aware of the existence of cases that the user doesn't have rights to.

Configuration examples for case permissions

In this example, visibility of cases is limited in a way that only those users can see the cases belonging to a user group which name is same as the Region (case attribute).

{
  "Permissions": {
    "Initialization": "Let(\"groupNames\", OrderByValue(CurrentUser.GroupNames))", 
    "Case": "Region.In(groupNames)",
    "EventLogKey": "StringJoin(\"_\", groupNames)"
  }
}

In this example, cases are only visible for users whose user name is same as the Account Manager (case attribute).

{
  "Permissions": {
    "Initialization": "Let(\"userName\", CurrentUser.Name)", 
    "Case": "(Attribute(\"Account Manager\") == userName)",
    "EventLogKey": "CurrentUser.Id"
  }
}

In this example, cases having "Region" case attribute of "Dallas" will only be visible for users belonging to user group "GroupA" (and "New York" for group "GroupB").

{
  "Permissions": {
    "Initialization": "Let(\"groupNames\", CurrentUser.GroupNames)", 
    "Case": "(Region == \"Dallas\" && \"GroupA\".In(groupNames)) || (Region == \"New York\" && \"GroupB\".In(groupNames))",
    "EventLogKey": "If(\"GroupA\".In(groupNames), \"_A\", \"_\") + If(\"GroupB\".In(groupNames), \"_B\", \"_\")"
  }
}